tags 31373 + patch
quit

"Basil L. Contovounesios" <contovob@tcd.ie> writes:

> On the latest emacs-26 and master branches, calling the function
> frame-list-z-order crashes a daemon Emacs via segfault:
>
> 1. ./src/emacs -Q --daemon=<name>
> 2. ./lib-src/emacsclient --socket-name=<name> --create-frame
> 3. cd src
> 4. gdb -p <PID of step (1)>
> 5. Issue 'continue' in gdb

You can also use

1. gdb ./emacs -Q --fg-daemon=<name>
2. Issue 'run' in gdb
3. ../lib-src/emacsclient --socket-name=<name> --create-frame

> 6. Evaluating (frame-list-z-order) in the emacsclient frame gives the
>    following output in gdb:
>
> Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
> 0x0000000000565112 in x_frame_list_z_order (dpy=0x33018f0, window=227) at xfns.c:5306
> 5306		    if (XFRAME (frame)->output_data.x->parent_desc == children[i]

> A quick step-through of x_frame_list_z_order indicates that the members
> of the struct XFRAME (frame)->output_data are initialised to NULL for
> the initial daemon frame F1.

Right, I think we need to check the frame's output_method field first.
I wonder if there are other cases like this?